🐧 A Linux Bug Hands Out Root & 🤖 AI Agents Steal 628K Records

Today's two big stories have the same lesson: attackers are getting faster and the defaults we trust aren't always safe. One is a years-old hole sitting in millions of Linux servers. The other shows AI agents running real attacks almost without a human involved.

Vghost: The Linux Bug That Turns Any User Into Root

Researchers at Tencent Zhuque Lab disclosed "Vghost" (CVE-2026-74580, severity 8.8). It's a flaw in the Linux kernel that lets an ordinary user take full control of a machine. It affects kernels going all the way back to version 4.11 and up to 7.2, and the researchers confirmed working attacks on five major Linux distributions. Worse, a malicious virtual machine can use the same bug to break out and hijack the host server it runs on, which matters a lot for cloud and hosting providers. RHEL, Amazon Linux, Azure Linux, and Oracle Linux all leave the vulnerable components open by default. If your business runs Linux servers (most do), ask your IT team to patch now. Until they can, they should lock down access to /dev/vhost-net and /dev/vhost-vsock.

Read more

Hackers Put AI on Autopilot and Stole 628,000 Records

A hacking group called CyberXero used Claude Code, a swarm of 51 AI agents, and standard hacking tools to run two attack campaigns. One automatically broke into WordPress and online-store websites. The other targeted Ukrainian energy and utility companies and stole more than 628,000 records. The speed is the scary part: in one run the AI scanned 4,708 targets, got into 429 admin panels, and planted 32 backdoors in 61 seconds. To get around the AI's safety refusals, the attackers claimed they were doing "authorized testing." For businesses, this means unpatched websites and exposed admin pages can now be found and exploited at machine speed, so basic hygiene can't wait.

Read more

Stay ahead of threats with GOCO Security at gocosecurity.com.